Listen to this Post
The vulnerability exists in OpenClaw’s Android component where a `CanvasScreen.kt` WebView exposes a JavascriptInterface bridge without validating the origin of loaded pages. Prior to the fix, any page—including those from untrusted external URLs or injected content—could invoke the bridge via `window.openclaw.` methods. This allowed an attacker to craft a malicious page that, once loaded in the WebView, could inject arbitrary instructions into the host application. Because the bridge lacked origin checks, the attacker could call native Android methods, execute system commands, or exfiltrate sensitive data. The root cause was the absence of origin snapshotting and trusted‑origin validation. The fix introduced CanvasActionTrust.kt, which centralizes origin‑based allow‑listing and rejects any call from an untrusted origin. The fix was applied in commit 8b02ef133275be96d8aac2283100016c8a7f32e5, released in version 2026.3.22, ensuring that only pages with a verified, trusted origin can access the bridge.
dailycve form
Platform: Android OpenClaw
Version: < 2026.3.22
Vulnerability: JS bridge injection
Severity: Critical
date: 2026-03-26
Prediction: Already patched (2026.3.22)
What Undercode Say:
Check currently installed OpenClaw npm version npm list openclaw Update to the fixed version npm install [email protected] Verify fix commit presence in local repo git log --oneline | grep 8b02ef1 Code snippet of the added origin validation (Kotlin) From CanvasActionTrust.kt: fun isTrustedOrigin(origin: String): Boolean { return listOf("https://trusted.domain", "file://").any { origin.startsWith(it) } }
Exploit:
An attacker tricks the app into loading a malicious HTML page (e.g., via a phishing link or injected iframe) inside the vulnerable WebView. The page then calls `window.openclaw.injectCommand(…)` or similar exposed methods, which the app executes with full native privileges before the fix.
Protection from this CVE
Update OpenClaw to version `2026.3.22` or later. If you maintain the app, ensure all WebViews that use JavascriptInterface perform strict origin validation, and follow the pattern in CanvasActionTrust.kt.
Impact
Successful exploitation allows an attacker to execute arbitrary native code within the app’s context, potentially leading to data theft, privilege escalation, or complete device compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
